Didn't that DNS changer also come wrapped up in some pirated iWorks suites offered on bit torrent servers, et al? I suppose if it was able to be bundled for install with an otherwise legitimate-appearing iWorks, it could be attached to any other installer's script, right?
_________________________
"We writhe with the best of them."